diff --git a/kibana/Dockerfile b/kibana/Dockerfile deleted file mode 100644 index 12fffd72..00000000 --- a/kibana/Dockerfile +++ /dev/null @@ -1,75 +0,0 @@ -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) -FROM docker.elastic.co/kibana/kibana:7.8.0 -USER kibana -ARG ELASTIC_VERSION=7.8.0 -ARG WAZUH_VERSION=3.13.1 -ARG WAZUH_APP_VERSION="${WAZUH_VERSION}_${ELASTIC_VERSION}" - -WORKDIR /usr/share/kibana -RUN ./bin/kibana-plugin install https://packages.wazuh.com/wazuhapp/wazuhapp-${WAZUH_APP_VERSION}.zip - -WORKDIR / -USER root -COPY config/entrypoint.sh ./entrypoint.sh -RUN chmod 755 ./entrypoint.sh - -ENV PATTERN="" \ - CHECKS_PATTERN="" \ - CHECKS_TEMPLATE="" \ - CHECKS_API="" \ - CHECKS_SETUP="" \ - EXTENSIONS_PCI="" \ - EXTENSIONS_GDPR="" \ - EXTENSIONS_AUDIT="" \ - EXTENSIONS_OSCAP="" \ - EXTENSIONS_CISCAT="" \ - EXTENSIONS_AWS="" \ - EXTENSIONS_VIRUSTOTAL="" \ - EXTENSIONS_OSQUERY="" \ - APP_TIMEOUT="" \ - WAZUH_SHARDS="" \ - WAZUH_REPLICAS="" \ - WAZUH_VERSION_SHARDS="" \ - WAZUH_VERSION_REPLICAS="" \ - IP_SELECTOR="" \ - IP_IGNORE="" \ - XPACK_RBAC_ENABLED="" \ - WAZUH_MONITORING_ENABLED="" \ - WAZUH_MONITORING_FREQUENCY="" \ - WAZUH_MONITORING_SHARDS="" \ - WAZUH_MONITORING_REPLICAS="" \ - ADMIN_PRIVILEGES="" - -ARG XPACK_CANVAS="true" -ARG XPACK_LOGS="true" -ARG XPACK_INFRA="true" -ARG XPACK_ML="true" -ARG XPACK_DEVTOOLS="true" -ARG XPACK_MONITORING="true" -ARG XPACK_APM="true" - -ARG CHANGE_WELCOME="false" - -COPY --chown=kibana:kibana ./config/wazuh_app_config.sh ./ - -RUN chmod +x ./wazuh_app_config.sh - -COPY --chown=kibana:kibana ./config/kibana_settings.sh ./ - -RUN chmod +x ./kibana_settings.sh - -COPY --chown=kibana:kibana ./config/xpack_config.sh ./ - -RUN chmod +x ./xpack_config.sh - -RUN ./xpack_config.sh - -COPY --chown=kibana:kibana ./config/welcome_wazuh.sh ./ - -RUN chmod +x ./welcome_wazuh.sh - -RUN ./welcome_wazuh.sh -USER kibana -RUN NODE_OPTIONS="--max-old-space-size=2048" /usr/local/bin/kibana-docker --optimize - -ENTRYPOINT ./entrypoint.sh diff --git a/kibana/config/entrypoint.sh b/kibana/config/entrypoint.sh deleted file mode 100644 index 1c445e10..00000000 --- a/kibana/config/entrypoint.sh +++ /dev/null @@ -1,57 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -set -e - -############################################################################## -# Waiting for elasticsearch -############################################################################## - -if [ "x${ELASTICSEARCH_URL}" = "x" ]; then - el_url="http://elasticsearch:9200" -else - el_url="${ELASTICSEARCH_URL}" -fi - -if [[ ${ENABLED_XPACK} != "true" || "x${ELASTICSEARCH_USERNAME}" = "x" || "x${ELASTICSEARCH_PASSWORD}" = "x" ]]; then - auth="" -else - auth="--user ${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" -fi - -until curl -XGET $el_url ${auth}; do - >&2 echo "Elastic is unavailable - sleeping" - sleep 5 -done - -sleep 2 - ->&2 echo "Elasticsearch is up." - - -############################################################################## -# Waiting for wazuh alerts template -############################################################################## - -strlen=0 - -while [[ $strlen -eq 0 ]] -do - template=$(curl $el_url/_cat/templates/wazuh -s) - strlen=${#template} - >&2 echo "Wazuh alerts template not loaded - sleeping." - sleep 2 -done - -sleep 2 - ->&2 echo "Wazuh alerts template is loaded." - - -./wazuh_app_config.sh - -sleep 5 - -./kibana_settings.sh & - -/usr/local/bin/kibana-docker diff --git a/kibana/config/kibana_settings.sh b/kibana/config/kibana_settings.sh deleted file mode 100644 index 2e53037d..00000000 --- a/kibana/config/kibana_settings.sh +++ /dev/null @@ -1,84 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -WAZUH_MAJOR=3 - -############################################################################## -# Wait for the Kibana API to start. It is necessary to do it in this container -# because the others are running Elastic Stack and we can not interrupt them. -# -# The following actions are performed: -# -# Add the wazuh alerts index as default. -# Set the Discover time interval to 24 hours instead of 15 minutes. -# Do not ask user to help providing usage statistics to Elastic. -############################################################################## - -############################################################################## -# Customize elasticsearch ip -############################################################################## -if [ "$ELASTICSEARCH_KIBANA_IP" != "" ]; then - sed -i "s:#elasticsearch.hosts:elasticsearch.hosts:g" /usr/share/kibana/config/kibana.yml - sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_KIBANA_IP'|g' /usr/share/kibana/config/kibana.yml -fi - -# If KIBANA_INDEX was set, then change the default index in kibana.yml configuration file. If there was an index, then delete it and recreate. -if [ "$KIBANA_INDEX" != "" ]; then - if grep -q 'kibana.index' /usr/share/kibana/config/kibana.yml; then - sed -i '/kibana.index/d' /usr/share/kibana/config/kibana.yml - fi - echo "kibana.index: $KIBANA_INDEX" >> /usr/share/kibana/config/kibana.yml -fi - -# If XPACK_SECURITY_ENABLED was set, then change the xpack.security.enabled option from true (default) to false. -if [ "$XPACK_SECURITY_ENABLED" != "" ]; then - if grep -q 'xpack.security.enabled' /usr/share/kibana/config/kibana.yml; then - sed -i '/xpack.security.enabled/d' /usr/share/kibana/config/kibana.yml - fi - echo "xpack.security.enabled: $XPACK_SECURITY_ENABLED" >> /usr/share/kibana/config/kibana.yml -fi - -if [ "$KIBANA_IP" != "" ]; then - kibana_ip="$KIBANA_IP" -else - kibana_ip="kibana" -fi - -# Add auth headers if required -if [ "$ELASTICSEARCH_USERNAME" != "" ] && [ "$ELASTICSEARCH_PASSWORD" != "" ]; then - curl_auth="-u $ELASTICSEARCH_USERNAME:$ELASTICSEARCH_PASSWORD" -fi - -while [[ "$(curl $curl_auth -XGET -I -s -o /dev/null -w ''%{http_code}'' $kibana_ip:5601/status)" != "200" ]]; do - echo "Waiting for Kibana API. Sleeping 5 seconds" - sleep 5 -done - -# Prepare index selection. -echo "Kibana API is running" - -default_index="/tmp/default_index.json" - -cat > ${default_index} << EOF -{ - "changes": { - "defaultIndex": "wazuh-alerts-${WAZUH_MAJOR}.x-*" - } -} -EOF - -sleep 5 -# Add the wazuh alerts index as default. -curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d@${default_index} -rm -f ${default_index} - -sleep 5 -# Configuring Kibana TimePicker. -curl -POST "http://$kibana_ip:5601/api/kibana/settings" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d \ -'{"changes":{"timepicker:timeDefaults":"{\n \"from\": \"now-24h\",\n \"to\": \"now\",\n \"mode\": \"quick\"}"}}' - -sleep 5 -# Do not ask user to help providing usage statistics to Elastic -curl -POST "http://$kibana_ip:5601/api/telemetry/v2/optIn" -H "Content-Type: application/json" -H "kbn-xsrf: true" -d '{"enabled":false}' - -echo "End settings" diff --git a/kibana/config/wazuh_app_config.sh b/kibana/config/wazuh_app_config.sh deleted file mode 100644 index cae2dcef..00000000 --- a/kibana/config/wazuh_app_config.sh +++ /dev/null @@ -1,68 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -wazuh_url="${WAZUH_API_URL:-https://wazuh}" -wazuh_port="${API_PORT:-55000}" -api_user="${API_USER:-foo}" -api_password="${API_PASS:-bar}" - -kibana_config_file="/usr/share/kibana/optimize/wazuh/config/wazuh.yml" -mkdir -p /usr/share/kibana/optimize/wazuh/config/ -touch $kibana_config_file - -declare -A CONFIG_MAP=( - [pattern]=$PATTERN - [checks.pattern]=$CHECKS_PATTERN - [checks.template]=$CHECKS_TEMPLATE - [checks.api]=$CHECKS_API - [checks.setup]=$CHECKS_SETUP - [extensions.pci]=$EXTENSIONS_PCI - [extensions.gdpr]=$EXTENSIONS_GDPR - [extensions.audit]=$EXTENSIONS_AUDIT - [extensions.oscap]=$EXTENSIONS_OSCAP - [extensions.ciscat]=$EXTENSIONS_CISCAT - [extensions.aws]=$EXTENSIONS_AWS - [extensions.virustotal]=$EXTENSIONS_VIRUSTOTAL - [extensions.osquery]=$EXTENSIONS_OSQUERY - [timeout]=$APP_TIMEOUT - [wazuh.shards]=$WAZUH_SHARDS - [wazuh.replicas]=$WAZUH_REPLICAS - [wazuh-version.shards]=$WAZUH_VERSION_SHARDS - [wazuh-version.replicas]=$WAZUH_VERSION_REPLICAS - [ip.selector]=$IP_SELECTOR - [ip.ignore]=$IP_IGNORE - [xpack.rbac.enabled]=$XPACK_RBAC_ENABLED - [wazuh.monitoring.enabled]=$WAZUH_MONITORING_ENABLED - [wazuh.monitoring.frequency]=$WAZUH_MONITORING_FREQUENCY - [wazuh.monitoring.shards]=$WAZUH_MONITORING_SHARDS - [wazuh.monitoring.replicas]=$WAZUH_MONITORING_REPLICAS - [admin]=$ADMIN_PRIVILEGES -) - -for i in "${!CONFIG_MAP[@]}" -do - if [ "${CONFIG_MAP[$i]}" != "" ]; then - sed -i 's/.*#'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file - fi -done - -# remove default API entry (new in 3.11.0_7.5.1) -sed -ie '/- default:/,+4d' $kibana_config_file - -CONFIG_CODE=$(curl -s -o /dev/null -w "%{http_code}" -XGET $el_url/.wazuh/_doc/1513629884013 ${auth}) - -grep -q 1513629884013 $kibana_config_file -_config_exists=$? - -if [[ "x$CONFIG_CODE" != "x200" && $_config_exists -ne 0 ]]; then -cat << EOF > $kibana_config_file -hosts: - - 1513629884013: - url: $wazuh_url - port: $wazuh_port - user: $api_user - password: $api_password -EOF -else - echo "Wazuh APP already configured" -fi diff --git a/kibana/config/welcome_wazuh.sh b/kibana/config/welcome_wazuh.sh deleted file mode 100644 index 98306871..00000000 --- a/kibana/config/welcome_wazuh.sh +++ /dev/null @@ -1,24 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -if [[ $CHANGE_WELCOME == "true" ]] -then - - rm -rf ./optimize/bundles - - kibana_path="/usr/share/kibana" - # Set Wazuh app as the default landing page - echo "Set Wazuh app as the default landing page" - echo "server.defaultRoute: /app/wazuh" >> /usr/share/kibana/config/kibana.yml - - # Redirect Kibana welcome screen to Discover - echo "Redirect Kibana welcome screen to Discover" - sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/global_nav/global_nav.html - sed -i "s:'/app/kibana#/home':'/app/wazuh':g" $kibana_path/src/ui/public/chrome/directives/header_global_nav/header_global_nav.js - - # Redirect Kibana welcome screen to Discover - echo "Hide undesired links" - sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/rollup/public/crud_app/index.js - sed -i 's#visible: true#visible: false#g' $kibana_path/node_modules/x-pack/plugins/license_management/public/management_section.js -fi - diff --git a/kibana/config/xpack_config.sh b/kibana/config/xpack_config.sh deleted file mode 100644 index 98e4a656..00000000 --- a/kibana/config/xpack_config.sh +++ /dev/null @@ -1,35 +0,0 @@ -#!/bin/bash -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -kibana_config_file="/usr/share/kibana/config/kibana.yml" -if grep -Fq "#xpack features" "$kibana_config_file"; -then - declare -A CONFIG_MAP=( - [xpack.apm.ui.enabled]=$XPACK_APM - [xpack.grokdebugger.enabled]=$XPACK_DEVTOOLS - [xpack.searchprofiler.enabled]=$XPACK_DEVTOOLS - [xpack.ml.enabled]=$XPACK_ML - [xpack.canvas.enabled]=$XPACK_CANVAS - [xpack.infra.enabled]=$XPACK_INFRA - [xpack.monitoring.enabled]=$XPACK_MONITORING - [console.enabled]=$XPACK_DEVTOOLS - ) - for i in "${!CONFIG_MAP[@]}" - do - if [ "${CONFIG_MAP[$i]}" != "" ]; then - sed -i 's/.'"$i"'.*/'"$i"': '"${CONFIG_MAP[$i]}"'/' $kibana_config_file - fi - done -else - echo " -#xpack features -xpack.apm.ui.enabled: $XPACK_APM -xpack.grokdebugger.enabled: $XPACK_DEVTOOLS -xpack.searchprofiler.enabled: $XPACK_DEVTOOLS -xpack.ml.enabled: $XPACK_ML -xpack.canvas.enabled: $XPACK_CANVAS -xpack.infra.enabled: $XPACK_INFRA -xpack.monitoring.enabled: $XPACK_MONITORING -console.enabled: $XPACK_DEVTOOLS -" >> $kibana_config_file -fi diff --git a/wazuh/Dockerfile b/wazuh/Dockerfile deleted file mode 100644 index ecd0855a..00000000 --- a/wazuh/Dockerfile +++ /dev/null @@ -1,59 +0,0 @@ -# Wazuh Docker Copyright (C) 2020 Wazuh Inc. (License GPLv2) -FROM centos:7 - -ARG FILEBEAT_VERSION=7.8.0 -ARG WAZUH_VERSION=3.13.1-1 -ARG TEMPLATE_VERSION="v3.13.1" -ARG WAZUH_FILEBEAT_MODULE="wazuh-filebeat-0.1.tar.gz" - -ENV API_USER="foo" \ - API_PASS="bar" - - -# Set repositories. -RUN rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH - -COPY config/wazuh.repo /etc/yum.repos.d/wazuh.repo - -RUN yum --enablerepo=updates clean metadata && \ - yum -y install openssl which && yum -y install wazuh-manager-${WAZUH_VERSION} -y && \ - curl --silent --location https://rpm.nodesource.com/setup_10.x | bash - && \ - yum -y install nodejs && yum -y install wazuh-api-${WAZUH_VERSION} && \ - sed -i "s/^enabled=1/enabled=0/" /etc/yum.repos.d/wazuh.repo && \ - yum clean all && rm -rf /var/cache/yum - -RUN curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-${FILEBEAT_VERSION}-x86_64.rpm &&\ - rpm -i filebeat-${FILEBEAT_VERSION}-x86_64.rpm && rm -f filebeat-${FILEBEAT_VERSION}-x86_64.rpm - -RUN curl -so /etc/filebeat/wazuh-template.json https://raw.githubusercontent.com/wazuh/wazuh/${TEMPLATE_VERSION}/extensions/elasticsearch/7.x/wazuh-template.json &&\ - chmod go+r /etc/filebeat/wazuh-template.json - -RUN curl -s https://packages.wazuh.com/3.x/filebeat/${WAZUH_FILEBEAT_MODULE} | tar -xvz -C /usr/share/filebeat/module - -ARG S6_VERSION="v2.0.0.1" -RUN curl --fail --silent -L https://github.com/just-containers/s6-overlay/releases/download/${S6_VERSION}/s6-overlay-amd64.tar.gz \ - -o /tmp/s6-overlay-amd64.tar.gz && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C / --exclude="./bin" && \ - tar xzf /tmp/s6-overlay-amd64.tar.gz -C /usr ./bin && \ - rm /tmp/s6-overlay-amd64.tar.gz - -COPY config/filebeat.yml /etc/filebeat/ - -RUN chmod go-w /etc/filebeat/filebeat.yml - -ADD https://raw.githubusercontent.com/wazuh/wazuh/$TEMPLATE_VERSION/extensions/elasticsearch/7.x/wazuh-template.json /etc/filebeat -RUN chmod go-w /etc/filebeat/wazuh-template.json - -COPY config/etc/ /etc/ - -# Prepare permanent data -# Sync calls are due to https://github.com/docker/docker/issues/9547 -COPY config/permanent_data.env config/permanent_data.sh / -RUN chmod 755 /permanent_data.sh && \ - sync && /permanent_data.sh && \ - sync && rm /permanent_data.sh - -# Services ports -EXPOSE 55000/tcp 1514/udp 1515/tcp 514/udp 1516/tcp - -ENTRYPOINT [ "/init" ] diff --git a/wazuh/config/etc/cont-init.d/0-wazuh-init b/wazuh/config/etc/cont-init.d/0-wazuh-init deleted file mode 100644 index b0cbd001..00000000 --- a/wazuh/config/etc/cont-init.d/0-wazuh-init +++ /dev/null @@ -1,232 +0,0 @@ -#!/usr/bin/with-contenv bash -# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -# Variables -source /permanent_data.env - -WAZUH_INSTALL_PATH=/var/ossec -WAZUH_CONFIG_MOUNT=/wazuh-config-mount -AUTO_ENROLLMENT_ENABLED=${AUTO_ENROLLMENT_ENABLED:-true} -API_GENERATE_CERTS=${API_GENERATE_CERTS:-true} - - -############################################################################## -# Aux functions -############################################################################## -print() { - echo -e $1 -} - -error_and_exit() { - echo "Error executing command: '$1'." - echo 'Exiting.' - exit 1 -} - -exec_cmd() { - eval $1 > /dev/null 2>&1 || error_and_exit "$1" -} - -exec_cmd_stdout() { - eval $1 2>&1 || error_and_exit "$1" -} - - -############################################################################## -# Edit configuration -############################################################################## - -edit_configuration() { # $1 -> setting, $2 -> value - sed -i "s/^config.$1\s=.*/config.$1 = \"$2\";/g" "${WAZUH_INSTALL_PATH}/api/configuration/config.js" || error_and_exit "sed (editing configuration)" -} - -############################################################################## -# This function will attempt to mount every directory in PERMANENT_DATA -# into the respective path. -# If the path is empty means permanent data volume is also empty, so a backup -# will be copied into it. Otherwise it will not be copied because there is -# already data inside the volume for the specified path. -############################################################################## - -mount_permanent_data() { - for permanent_dir in "${PERMANENT_DATA[@]}"; do - # Check if the path is not empty - if find ${permanent_dir} -mindepth 1 | read; then - print "The path ${permanent_dir} is already mounted" - else - print "Installing ${permanent_dir}" - exec_cmd "cp -a ${WAZUH_INSTALL_PATH}/data_tmp/permanent${permanent_dir}/. ${permanent_dir}" - fi - done -} - -############################################################################## -# This function will replace from the permanent data volume every file -# contained in PERMANENT_DATA_EXCP -# Some files as 'internal_options.conf' are saved as permanent data, but -# they must be updated to work properly if wazuh version is changed. -############################################################################## - -apply_exclusion_data() { - for exclusion_file in "${PERMANENT_DATA_EXCP[@]}"; do - if [ -e ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ] - then - DIR=$(dirname "${exclusion_file}") - if [ ! -e ${DIR} ] - then - mkdir -p ${DIR} - fi - - print "Updating ${exclusion_file}" - exec_cmd "cp -p ${WAZUH_INSTALL_PATH}/data_tmp/exclusion/${exclusion_file} ${exclusion_file}" - fi - done -} - -############################################################################## -# This function will delete from the permanent data volume every file -# contained in PERMANENT_DATA_DEL -############################################################################## - -remove_data_files() { - for del_file in "${PERMANENT_DATA_DEL[@]}"; do - if [ -e ${del_file} ] - then - print "Removing ${del_file}" - exec_cmd "rm ${del_file}" - fi - done -} - -############################################################################## -# Create certificates: Manager -############################################################################## - -create_ossec_key_cert() { - print "Creating ossec-authd key and cert" - exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.key 4096" - exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/etc/sslmanager.key -out ${WAZUH_INSTALL_PATH}/etc/sslmanager.cert -days 3650 -subj /CN=${HOSTNAME}/" -} - -############################################################################## -# Create certificates: API -############################################################################## - -create_api_key_cert() { - print "Enabling Wazuh API HTTPS" - edit_configuration "https" "yes" - print "Create Wazuh API key and cert" - exec_cmd "openssl genrsa -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key 4096" - exec_cmd "openssl req -new -x509 -key ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key -out ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt -days 3650 -subj /CN=${HOSTNAME}/" - - # Granting proper permissions - chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.key - chmod 400 ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt -} - -############################################################################## -# Copy all files from $WAZUH_CONFIG_MOUNT to $WAZUH_INSTALL_PATH and respect -# destination files permissions -# -# For example, to mount the file /var/ossec/data/etc/ossec.conf, mount it at -# $WAZUH_CONFIG_MOUNT/etc/ossec.conf in your container and this code will -# replace the ossec.conf file in /var/ossec/data/etc with yours. -############################################################################## - -mount_files() { - if [ -e "$WAZUH_CONFIG_MOUNT" ] - then - print "Identified Wazuh configuration files to mount..." - exec_cmd_stdout "cp --verbose -r $WAZUH_CONFIG_MOUNT/* $WAZUH_INSTALL_PATH" - else - print "No Wazuh configuration files to mount..." - fi -} - -############################################################################## -# Stop OSSEC -############################################################################## - -function ossec_shutdown(){ - ${WAZUH_INSTALL_PATH}/bin/ossec-control stop; -} - -############################################################################## -# Interpret any passed arguments (via docker command to this entrypoint) as -# paths or commands, and execute them. -# -# This can be useful for actions that need to be run before the services are -# started, such as "/var/ossec/bin/ossec-control enable agentless". -############################################################################## - -docker_custom_args() { - for CUSTOM_COMMAND in "$@" - do - echo "Executing command \`${CUSTOM_COMMAND}\`" - exec_cmd_stdout "${CUSTOM_COMMAND}" - done -} - -############################################################################## -# Change Wazuh API user credentials. -############################################################################## - -change_api_user_credentials() { - pushd /var/ossec/api/configuration/auth/ - echo "Change Wazuh API user credentials" - change_user="node htpasswd -b -c user $API_USER $API_PASS" - eval $change_user - popd -} - - -############################################################################## -# Main function -############################################################################## - -main() { - # Mount permanent data (i.e. ossec.conf) - mount_permanent_data - - # Restore files stored in permanent data that are not permanent (i.e. internal_options.conf) - apply_exclusion_data - - # Remove some files in permanent_data (i.e. .template.db) - remove_data_files - - # Generate ossec-authd certs if AUTO_ENROLLMENT_ENABLED is true and does not exist - if [ $AUTO_ENROLLMENT_ENABLED == true ] - then - if [ ! -e ${WAZUH_INSTALL_PATH}/etc/sslmanager.key ] - then - create_ossec_key_cert - fi - fi - - # Generate API certs if API_GENERATE_CERTS is true and does not exist - if [ $API_GENERATE_CERTS == true ] - then - if [ ! -e ${WAZUH_INSTALL_PATH}/api/configuration/ssl/server.crt ] - then - create_api_key_cert - fi - fi - - # Mount selected files (WAZUH_CONFIG_MOUNT) to container - mount_files - - # Trap exit signals and do a proper shutdown - trap "ossec_shutdown; exit" SIGINT SIGTERM - - # Execute custom args - docker_custom_args - - # Change API user credentials - change_api_user_credentials - - # Delete temporary data folder - rm -rf ${WAZUH_INSTALL_PATH}/data_tmp - -} - -main diff --git a/wazuh/config/etc/cont-init.d/1-config-filebeat b/wazuh/config/etc/cont-init.d/1-config-filebeat deleted file mode 100644 index 181e3e1a..00000000 --- a/wazuh/config/etc/cont-init.d/1-config-filebeat +++ /dev/null @@ -1,31 +0,0 @@ -#!/usr/bin/with-contenv bash -# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -set -e - -WAZUH_FILEBEAT_MODULE=wazuh-filebeat-0.1.tar.gz - -if [ "$ELASTICSEARCH_URL" != "" ]; then - >&2 echo "Customize Elasticsearch ouput IP" - sed -i 's|http://elasticsearch:9200|'$ELASTICSEARCH_URL'|g' /etc/filebeat/filebeat.yml -fi - -# Configure filebeat.yml security settings - -if [ "$SSL_CERTIFICATE_AUTHORITIES" != "" ]; then - >&2 echo "Configuring Certificate Authorities." - sed -i 's|#ssl.certificate_authorities:|'ssl.certificate_authorities:\ [\"$SSL_CERTIFICATE_AUTHORITIES\"]'|g' /etc/filebeat/filebeat.yml -fi - -if [ "$USERNAME" != "" ]; then - >&2 echo "Configuring username." - sed -i 's|#username:|'username:\ \"$USERNAME\"'|g' /etc/filebeat/filebeat.yml -fi - -if [ "$PASSWORD" != "" ]; then - >&2 echo "Configuring password." - sed -i 's|#password:|'password:\ \"$PASSWORD\"'|g' /etc/filebeat/filebeat.yml -fi - -chmod go-w /etc/filebeat/filebeat.yml || true -chown root: /etc/filebeat/filebeat.yml || true diff --git a/wazuh/config/etc/cont-init.d/2-manager b/wazuh/config/etc/cont-init.d/2-manager deleted file mode 100644 index e548e8b1..00000000 --- a/wazuh/config/etc/cont-init.d/2-manager +++ /dev/null @@ -1,3 +0,0 @@ -#!/usr/bin/with-contenv bash - -/var/ossec/bin/ossec-control start diff --git a/wazuh/config/etc/services.d/api/finish b/wazuh/config/etc/services.d/api/finish deleted file mode 100644 index 38d744d1..00000000 --- a/wazuh/config/etc/services.d/api/finish +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env sh -echo >&2 "API exited. code=${1}" - -# terminate other services to exit from the container -exec s6-svscanctl -t /var/run/s6/services - diff --git a/wazuh/config/etc/services.d/api/run b/wazuh/config/etc/services.d/api/run deleted file mode 100644 index e6e3e831..00000000 --- a/wazuh/config/etc/services.d/api/run +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/with-contenv sh -echo >&2 "starting API" - -exec /bin/node /var/ossec/api/app.js diff --git a/wazuh/config/etc/services.d/filebeat/finish b/wazuh/config/etc/services.d/filebeat/finish deleted file mode 100644 index 8813eb67..00000000 --- a/wazuh/config/etc/services.d/filebeat/finish +++ /dev/null @@ -1,6 +0,0 @@ -#!/usr/bin/env sh -echo >&2 "Filebeat exited. code=${1}" - -# terminate other services to exit from the container -exec s6-svscanctl -t /var/run/s6/services - diff --git a/wazuh/config/etc/services.d/filebeat/run b/wazuh/config/etc/services.d/filebeat/run deleted file mode 100644 index 706ee5af..00000000 --- a/wazuh/config/etc/services.d/filebeat/run +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/with-contenv sh -echo >&2 "starting Filebeat" - -exec /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat diff --git a/wazuh/config/filebeat.yml b/wazuh/config/filebeat.yml deleted file mode 100644 index 0d04bac8..00000000 --- a/wazuh/config/filebeat.yml +++ /dev/null @@ -1,21 +0,0 @@ - -# Wazuh - Filebeat configuration file -filebeat.modules: - - module: wazuh - alerts: - enabled: true - archives: - enabled: false - -setup.template.json.enabled: true -setup.template.json.path: '/etc/filebeat/wazuh-template.json' -setup.template.json.name: 'wazuh' -setup.template.overwrite: true -setup.ilm.enabled: false -output.elasticsearch: - hosts: ['http://elasticsearch:9200'] - #ssl.certificate_authorities: - #ssl.certificate: - #ssl.key: - #username: - #password: diff --git a/wazuh/config/permanent_data.env b/wazuh/config/permanent_data.env deleted file mode 100644 index ca461d63..00000000 --- a/wazuh/config/permanent_data.env +++ /dev/null @@ -1,74 +0,0 @@ -# Permanent data mounted in volumes -i=0 -PERMANENT_DATA[((i++))]="/var/ossec/api/configuration" -PERMANENT_DATA[((i++))]="/var/ossec/etc" -PERMANENT_DATA[((i++))]="/var/ossec/logs" -PERMANENT_DATA[((i++))]="/var/ossec/queue" -PERMANENT_DATA[((i++))]="/var/ossec/agentless" -PERMANENT_DATA[((i++))]="/var/ossec/var/multigroups" -PERMANENT_DATA[((i++))]="/var/ossec/integrations" -PERMANENT_DATA[((i++))]="/var/ossec/active-response/bin" -PERMANENT_DATA[((i++))]="/var/ossec/wodles" -PERMANENT_DATA[((i++))]="/etc/filebeat" -export PERMANENT_DATA - -# Files mounted in a volume that should not be permanent -i=0 -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/etc/internal_options.conf" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/pagerduty" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/slack.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/integrations/virustotal.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/default-firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/disable-account.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewalld-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/firewall-drop.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/host-deny.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ip-customblock.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw_mac.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ipfw.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/kaspersky.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/npf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-slack.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/ossec-tweeter.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/pf.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart-ossec.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/restart.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/active-response/bin/route-null.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/sshlogin.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_pixconfig_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_asa-fwsmconfig_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_bsd" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/main.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/su.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_integrity_check_linux" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/register_host.sh" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_generic_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_foundry_diff" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh_nopass.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/agentless/ssh.exp" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/aws/aws-s3.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/azure/azure-logs.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/docker/DockerListener.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/oscap.py" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_oval.xsl" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/template_xccdf.xsl" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-redhat-6-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/cve-redhat-7-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-centos-6-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-centos-7-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-fedora-24-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-rhel-6-ds.xml" -PERMANENT_DATA_EXCP[((i++))]="/var/ossec/wodles/oscap/content/ssg-rhel-7-ds.xml" -export PERMANENT_DATA_EXCP - -# Files mounted in a volume that should be deleted -i=0 -PERMANENT_DATA_DEL[((i++))]="/var/ossec/queue/db/.template.db" -export PERMANENT_DATA_DEL diff --git a/wazuh/config/permanent_data.sh b/wazuh/config/permanent_data.sh deleted file mode 100644 index 7dfaa647..00000000 --- a/wazuh/config/permanent_data.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/bash -# Wazuh App Copyright (C) 2020 Wazuh Inc. (License GPLv2) - -# Variables -source /permanent_data.env - -WAZUH_INSTALL_PATH=/var/ossec -DATA_TMP_PATH=${WAZUH_INSTALL_PATH}/data_tmp -mkdir ${DATA_TMP_PATH} - -# Move exclusion files to EXCLUSION_PATH -EXCLUSION_PATH=${DATA_TMP_PATH}/exclusion -mkdir ${EXCLUSION_PATH} - -for exclusion_file in "${PERMANENT_DATA_EXCP[@]}"; do - # Create the directory for the exclusion file if it does not exist - DIR=$(dirname "${exclusion_file}") - if [ ! -e ${EXCLUSION_PATH}/${DIR} ] - then - mkdir -p ${EXCLUSION_PATH}/${DIR} - fi - - mv ${exclusion_file} ${EXCLUSION_PATH}/${exclusion_file} -done - -# Move permanent files to PERMANENT_PATH -PERMANENT_PATH=${DATA_TMP_PATH}/permanent -mkdir ${PERMANENT_PATH} - -for permanent_dir in "${PERMANENT_DATA[@]}"; do - # Create the directory for the permanent file if it does not exist - DIR=$(dirname "${permanent_dir}") - if [ ! -e ${PERMANENT_PATH}${DIR} ] - then - mkdir -p ${PERMANENT_PATH}${DIR} - fi - - mv ${permanent_dir} ${PERMANENT_PATH}${permanent_dir} - -done diff --git a/wazuh/config/wazuh.repo b/wazuh/config/wazuh.repo deleted file mode 100644 index ae462c62..00000000 --- a/wazuh/config/wazuh.repo +++ /dev/null @@ -1,7 +0,0 @@ -[wazuh_repo] -gpgcheck=1 -gpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH -enabled=1 -name=Wazuh repository -baseurl=https://packages.wazuh.com/3.x/yum/ -protect=1